Azure Key Vault Key Modified or Deleted via Activity Log

Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.

FreeUnreviewedSigmamediumv1

azure-key-vault-key-modified-or-deleted-via-activity-log-80eeab92

title: Azure Key Vault Key Modified or Deleted via Activity Log
id: 50890364-4ffb-4f34-866b-6fc32c81d15c
status: test
description: This rule flags Azure Activity Log events indicating a Key Vault key was created, imported, updated, recovered, restored, backed up, purged, or deleted. Key modification or deletion is significant because it can disrupt cryptographic operations or enable unauthorized access depending on how the key is used. It relies on Activity Log telemetry with operationName values for Key Vault key lifecycle actions.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION
  condition: selection
falsepositives:
  - Key being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 80eeab92-0979-4152-942d-96749e11df40
    type: derived

What it detects

This rule flags Azure Activity Log events indicating a Key Vault key was created, imported, updated, recovered, restored, backed up, purged, or deleted. Key modification or deletion is significant because it can disrupt cryptographic operations or enable unauthorized access depending on how the key is used. It relies on Activity Log telemetry with operationName values for Key Vault key lifecycle actions.

Known false positives

Key being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.